HL
Product
Hcl Launch
28
CVEs
0
On KEV
7.6
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 24Low 0
Watch
Add Hcl Launch to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0272 | 7.6 | Apr 3 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection Affected: 7.0.0.0 through 7.0.5.26; 7.1.0.0 before 7.1.2.22; 7.2.0.0 before 7.2.3.15; 7.3.0.0 through 7.3.2.9 |
| CVE-2025-0257 | 7.5 | Apr 2 | HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service Affected: 7.1.0.0 before 7.1.2.23; 7.2.0.0 before 7.2.3.16; 7.3.0.0 before 7.3.2.11 |
| CVE-2023-45703 | 7.5 | Dec 21 | HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion Affected: 7.0.0.0 through 7.0.5.18; 7.1.0.0 through 7.1.2.14; 7.2.0.0 through 7.2.3.7; 7.3.0.0 through 7.3.2.2 |
| CVE-2025-0255 | 7.2 | Mar 24 | HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing… Affected: 7.0.0.0 before 7.0.5.26; 7.1.0.0 before 7.1.2.22; 7.2.0.0 before 7.2.3.15; 7.3.0.0 before 7.3.2.10 |
| CVE-2024-42195 | 6.8 | Dec 5 | HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection Affected: 7.0.0.0 before 7.0.5.25; 7.1.0.0 before 7.1.2.21; 7.2.0.0 before 7.2.3.14; 7.3.0.0 before 7.3.2.9 |
| CVE-2026-56460 | 6.5 | Jul 9 | HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability Affected: 7.3.0.0 before 7.3.2.19 |
| CVE-2025-0256 | 6.5 | Mar 24 | HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function Affected: 7.0.0.0 before 7.0.5.26; 7.1.0.0 before 7.1.2.22; 7.2.0.0 before 7.2.3.15; 7.3.0.0 before 7.3.2.10 |
| CVE-2023-45701 | 6.5 | Dec 28 | HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 7.0.0.0 through 7.0.5.18; 7.1.0.0 through 7.1.2.14; 7.2.0.0 through 7.2.3.7; 7.3.0.0 through 7.3.2.2 |
| CVE-2022-27551 | 6.5 | Aug 3 | HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551) Affected: 7.0.0.0 before 7.0.5.12; 7.1.0.0 before 7.1.2.8; 7.2.0.0 before 7.2.3.1 |
| CVE-2024-23558 | 6.3 | Apr 15 | HCL DevOps Deploy / HCL Launch does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system Affected: 7.0.0.0 before 7.0.5.21; 7.1.0.0 before 7.1.2.17; 7.2.0.0 before 7.2.3.10; 7.3.0.0 before 7.3.2.5 |
| CVE-2025-59849 | 6.1 | Dec 17 | Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages Affected: 7.3.0.0 before 7.3.2.16 |
| CVE-2024-23559 | 6.1 | Apr 15 | HCL DevOps Deploy / Launch is generating an obsolete HTTP header Affected: 7.0.0.0 before 7.0.5.21; 7.1.0.0 before 7.1.2.17; 7.2.0.0 before 7.2.3.10; 7.3.0.0 before 7.3.2.5 |
| CVE-2025-62329 | 5.6 | Dec 16 | HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP… Affected: 7.3.0.0 before 7.3.2.16 |
| CVE-2026-56459 | 5.5 | Jul 9 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure Affected: 7.3.0.0 before 7.3.2.19 |
| CVE-2025-0273 | 5.5 | Mar 27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user Affected: 7.0.0.0 through 7.0.5.26; 7.1.0.0 before 7.1.2.22; 7.2.0.0 before 7.2.3.15; 7.3.0.0 through 7.3.2.9 |
| CVE-2024-42196 | 5.5 | Dec 6 | HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs Affected: 7.0.0.0 before 7.0.5.25; 7.1.0.0 before 7.1.2.21; 7.2.0.0 before 7.2.3.14 |
| CVE-2024-23550 | 5.5 | Feb 3 | HCL DevOps Deploy / HCL Launch (UCD) could disclose sensitive user information when installing the Windows agent Affected: 7.0.0.0 before 7.0.5.20; 7.1.0.0 before 7.1.2.16; 7.2.0.0 before 7.2.3.9; 7.3.0.0 before 7.3.2.4 |
| CVE-2023-45702 | 5.5 | Dec 28 | An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts Affected: 7.2.0.0 through 7.2.3.7; 7.3.0.0 through 7.3.2.2 |
| CVE-2023-23348 | 5.5 | Jul 10 | HCL Launch could disclose sensitive information if a manual edit of a configuration file has been performed Affected: 6.2.0.0 before 6.2.7.20; 7.0.0.0 before 7.0.5.15; 7.1.0.0 before 7.1.2.11; 7.2.0.0 before 7.2.3.4; 7.3.0.0 before 7.3.1.0 |
| CVE-2022-27549 | 5.5 | Jul 6 | HCL Launch may store certain data for recurring activities in a plain text format Affected: 7.0.5.10; 7.1.2.6; 7.2.2.1 |
| CVE-2022-27548 | 5.5 | Jul 6 | HCL Launch stores user credentials in plain clear text which can be read by a local user Affected: 7.0.5.10; 7.1.2.6; 7.2.2.1 |
| CVE-2023-45700 | 5.4 | Dec 21 | HCL Launch is vulnerable to HTML injection Affected: 7.1.0.0 through 7.1.2.14; 7.2.0.0 through 7.2.3.7; 7.3.0.0 through 7.3.2.2 |
| CVE-2022-42452 | 5.4 | Apr 2 | HCL Launch is vulnerable to HTML injection Affected: 6.2.0.0 through 6.2.7.18; 7.0.5.0 through 7.0.5.13; 7.1.0.0 through 7.1.2.9; 7.2.0.0 through 7.2.3.2; 7.3.0.0 |
| CVE-2024-23560 | 4.9 | Apr 15 | HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type Affected: 7.0.0.0 before 7.0.5.21; 7.1.0.0 before 7.1.2.17; 7.2.0.0 before 7.2.3.10; 7.3.0.0 before 7.3.2.5 |
| CVE-2022-42445 | 4.9 | Dec 12 | HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing… Affected: 6.2.7.0 through 6.2.7.17; 7.0.0.0 through 7.0.5.12; 7.1.0.0 through 7.1.2.8; 7.2.0.0 through 7.2.3.1 |
| CVE-2025-55254 | 4.8 | Dec 17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain… Affected: 7.3.0.0 before 7.3.2.16 |
| CVE-2026-56457 | 4.3 | Jun 29 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information Affected: 7.3.0.0 before 7.3.2.19 |
| CVE-2024-23561 | 4.3 | Apr 15 | HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive values Affected: 7.0.0.0 before 7.0.5.21; 7.1.0.0 before 7.1.2.17; 7.2.0.0 before 7.2.3.10; 7.3.0.0 before 7.3.2.5 |
Showing 28